bugdavfs2 - Bugs: bug #58459, cookie handling in webdav.c...

 
 

bug #58459: cookie handling in webdav.c revision 1.35

Submitter:  None
Submitted:  Thu 28 May 2020 06:46:23 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  _71007
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 08 Jun 2020 09:50:34 AM UTC, comment #1: 

I fixed the issues in the CVS-sources.

Some comments:
[1] This is the easy one. The list seperator in HTTP-headers is the comma, so it is a bug in RFC6265. But after 20 years and three RFC's this bug is still there. So applications will have to follow that buggy RFC.

[2] This was more difficult. In HTTP each header should only appear once. Multiple values should be send as list, seperated by commas. But because of that stupid date-format lists are not possible with Set-Cookie. So more than on Set-Cookie header is possible and I have to scan all headers for that one.

[3] If required the cookie_list is created at program start and then needed until the end. When the program terminates the operating system will free all of its memory. No need to write code for this. Debugging tools may have problems to notice the differnce.

Werner

- <_71007>
Thu 28 May 2020 06:46:23 AM UTC, original submission:  

If activating the usage of cookies, I see some misbehavior.

[1] function add_header() uses comma instead of semicolon for multiple cookie
In RFC6265 section 4.2.1 it is specified, that a semicolon should be used for separation of multiple cookies

https://tools.ietf.org/html/rfc6265#section-4.2.1


[2] function get_cookies() uses comma to parse multiple cookie-pairs
In RFC6265 section 4.1.1 it is specified, that a semicolon should be used for separation of multiple cookies
A comma might be used in the Expire value e.g.
Set-Cookie: lang=; Expires=Sun, 06 Nov 1994 08:49:37 GMT

https://tools.ietf.org/html/rfc6265#section-4.1.1

[3] the variable cookie_list is not freed
It might be useful to cleanup the allocated resources in order to identify real memory leaks

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by _71007 (Posted a comment)
  • -email is unavailable- added by sreschke (SRE)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-06-08 _71007 StatusNone Fixed
        Assigned toNone _71007
    2020-06-06 sreschke Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code